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ABSTRACT 

In  this  paper,  an  approach  for  in-flight  fault  detection  and 
isolation  (FDI)  of  aircraft  engine  sensors  based  on  a  bank  of 
Kalman  filters  is  developed.  This  approach  utilizes  multiple 
Kalman  filters,  each  of  which  is  designed  based  on  a  specific 
fault  hypothesis.  When  the  propulsion  system  experiences  a 
fault,  only  one  Kalman  filter  with  the  correct  hypothesis  is  able 
to  maintain  the  nominal  estimation  performance.  Based  on  this 
knowledge,  the  isolation  of  faults  is  achieved.  Since  the 
propulsion  system  may  experience  component  and  actuator 
faults  as  well,  a  sensor  FDI  system  must  be  robust  in  terms  of 
avoiding  misclassifications  of  any  anomalies.  The  proposed 
approach  utilizes  a  bank  of  (m+1)  Kalman  filters  where  m  is  the 
number  of  sensors  being  monitored.  One  Kalman  filter  is  used 
for  the  detection  of  component  and  actuator  faults  while  each  of 
the  other  m  filters  detects  a  fault  in  a  specific  sensor.  With  this 
setup,  the  overall  robustness  of  the  sensor  FDI  system  to 
anomalies  is  enhanced.  Moreover,  numerous  component  fault 
events  can  be  accounted  for  by  the  FDI  system.  The  sensor  FDI 
system  is  applied  to  a  commercial  aircraft  engine  simulation, 
and  its  performance  is  evaluated  at  multiple  power  settings  at  a 
cruise  operating  point  using  various  fault  scenarios. 


INTRODUCTION 

In-flight  sensor  fault  detection  and  isolation  (FDI)  is 
critical  to  maintaining  reliable  engine  operation  during  flight. 
The  propulsion  system  is  operated  at  demanded  conditions  by 
the  aircraft  engine  control  system  which  computes  control 
commands  based  on  sensor  measurements.  Any  undetected 
sensor  faults,  therefore,  may  cause  the  control  system  to  drive 
the  engine  into  an  undesirable  operating  condition.  If  a  sensor 
fails,  it  is  crucial  to  detect  and  isolate  the  fault  as  soon  as 
possible  so  that  such  scenarios  can  be  avoided.  A  sensor  FDI 
system  which  is  capable  of  doing  so  with  high  reliability  is 
indispensable  for  flight  safety  enhancement.  A  challenging 
issue  in  developing  reliable  sensor  FDI  systems  is  to  make 
them  robust  to  other  faults,  besides  sensor  faults,  that  can  occur 
during  flight.  Engine  component  performance  can  degrade 


Donald  L.  Simon 

U.S.  Army  Research  Laboratory 
Glenn  Research  Center 
Cleveland,  Ohio  44135 


gradually  due  to  usage,  and  abruptly  due  to  fault  events  such  as 
foreign  or  domestic  object  damage.  Likewise,  errors  can  exist 
between  the  commanded  and  actual  actuator  positions.  Such 
anomalies  result  in  shifts  in  sensed  engine  variables  from  their 
nominal  values.  Therefore,  a  sensor  FDI  system  which  is 
developed  without  accounting  for  possible  component  or 
actuator  faults  may  result  in  false  alarms,  missed  detections,  or 
misclassifications  when  such  faults  do  occur. 

An  approach  to  in-flight  sensor  FDI  for  aircraft  propulsion 
system  was  addressed  by  Merrill  et  al.  [1]  through  the 
utilization  of  a  bank  of  Kalman  filters.  In  this  approach,  each 
Kalman  filter  is  designed  based  on  a  specific  hypothesis  (such 
as  the  failure  of  a  specific  sensor).  When  a  single  sensor  fails, 
only  the  one  Kalman  filter  with  the  correct  fault  hypothesis  can 
maintain  low  residual  values,  indicating  that  the  specific  sensor 
has  failed.  This  work  was  later  extended  by  Kobayashi  et  al. 
[2]  to  account  for  not  only  sensor  faults,  but  also  actuator  and 
component  faults.  This  approach  exhibited  improved  robustness 
of  the  FDI  system;  however,  the  number  of  component  fault 
events  that  could  be  accounted  for  by  the  FDI  system  was 
limited  to  the  number  of  available  sensors.  In  spite  of  such 
limitations,  the  previous  research  [2]  revealed  potential  areas 
for  further  improvement  of  an  FDI  system.  In  this  paper, 
lessons  learned  from  the  earlier  work  are  incorporated  to 
enhance  the  bank  of  Kalman  filters  for  an  in-flight  sensor  FDI 
application.  The  objectives  of  sensor  FDI  are  as  follows: 

•  Avoid  missed  detections:  When  a  single  sensor  is 
faulty,  it  must  be  correctly  detected  and  isolated. 

•  Avoid  false  alarms:  Non-fault-related  factors  that  exist 
in  the  real  environment,  such  as  sensor  noise  and 
modeling  uncertainty,  should  not  be  diagnosed  as  a 
sensor  fault. 

•  Avoid  misclassifications:  Component  or  actuator 
faults  should  not  be  misclassified  as  a  sensor  fault. 

In  this  paper,  a  sensor  FDI  system  is  developed  and  applied 
to  a  nonlinear  simulation  of  a  commercial  aircraft  gas  turbine 
engine.  The  FDI  system  performance  is  evaluated  at  multiple 
power  settings  at  a  cruise  operating  point  using  various  fault 
scenarios. 
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NOMENCLATURE 


BST 

Booster 

FAN 

Fan 

FDI 

Fault  detection  and  isolation 

HPC 

High-pressure  compressor 

HPT 

High-pressure  turbine 

LPT 

Low-pressure  turbine 

P25 

HPC  inlet  pressure 

PLA 

Power  lever  angle 

PS3 

Combustor  inlet  static  pressure 

T25 

HPC  inlet  temperature 

T3 

Combustor  inlet  temperature 

T49 

LPT  inlet  temperature' 

TMHS23 

BST  metal  temperature 

TMHS3 

HPC  metal  temperature 

TMHS41 

HPT  nozzle  metal  temperature 

TMHS42 

HPT  metal  temperature 

TMHS5 

LPT  metal  temperature 

TMHSBC 

Combustor  ease  metal  temperature 

TMHSBL 

Combustor  liner  metal  temperature 

VBV 

Variable  bleed  valve 

VSV 

Variable  stator  vane 

WF36 

Fuel  flow 

XN12 

Low-pressure  spool  speed,  measured 

XN25 

High-pressure  spool  speed,  measured 

XNH 

High-pressure  spool  speed,  state  variable 

XNL 

Low-pressure  spool  speed,  state  variable 

DEVELOPMENT  OF  ROBUST  SENSOR  FAULT 
DETECTION  AND  ISOLATION  SYSTEM 

The  problem  approach  to  sensor  FDI  is  similar  to  that  of 
reference  [2],  A  depiction  of  the  propulsion  system  with  the 
sensor  FDI  system  is  shown  in  fig,  L  During  flight,  the  sensors, 
actuators,  and  engine  components  are  susceptible  to  failure. 
The  sensor  and  actuator  faults  dealt  with  in  this  paper  are  “soft” 
failures.  Soft  failures  are  defined  as  inconsistencies  between 
true  and  measured  sensor  values  (or  true  and  commanded 
actuator  position)  that  are  relatively  small  in  magnitude  and 
thus  difficult  to  detect,  whereas  “hard”  failures  are  large  in 
magnitude  and  thus  more  readily  detectable.  Soft  failures  can 
take  different  forms  such  as  a  fixed  scale  factor,  a  fixed  bias,  a 
drift,  or  intermittent  spikes.  Among  these,  only  the  fixed  bias  is 
considered  in  this  paper  for  FDI  evaluation  purposes,  although 
the  proposed  FDI  approach  is  applicable  to  other  soft  failure 
types  as  well.  Engine  component  faults  are  modeled  in  the 
simulation  environment  by  abruptly  shifting  the  health 


Component 

Actuator  Fault  Fault  Sensor  Fault 


In-flight  FDI 

*  Sensor  fault  detection  and  isolation 

*  Detection  of  component/actuator  fault 


Figure  1.  Propulsion  System  with  Sensor  Fault 
Detection  and  Isolation  System 


parameters  which  Indicate  component  performance  deviations 
from  a  reference  base  point. 

The  FDI  system  uses  two  sets  of  input  signals:  sensor 
measurements  and  control  commands.  Those  sensors  used  by 
the  control  system  are  also  used  by  the  FDI  system  for 
monitoring  purposes.  Given  these  two  sets  of  input  signals,  the 
FDI  system  seeks  to  detect  and  isolate  any  faulty  sensors.  The 
approach  to  sensor  FDI  is  based  on  the  utilization  of  a  bank  of 
Kalman  filters,  where  each  filter  is  designed  with  a  unique 
hypothesis  to  monitor  a  specific  sensor.  In  addition  to  sensors, 
components  and  actuators  may  also  fail  during  flight. 
Therefore,  it  is  necessary  to  make  the  FDI  system  robust  to 
these  faults  so  that  misclassifications  of  component  and 
actuator  faults  as  sensor  faults  do  not  occur.  This  issue  is 
addressed  by  designing  one  additional  Kalman  filter  which 
assumes  that  components  and  actuators  may  be  faulty.  When 
the  propulsion  system  experiences  a  sensor  fault  or 
component/actuator  faults,  only  the  one  Kalman  filter  with  the 
correct  hypothesis  is  able  to  maintain  accurate  estimation 
performance.  Consequently,  the  detection  and  isolation  of 
sensor  faults  or  the  detection  of  component/actuator  faults  can 
be  achieved.  As  can  be  seen  in  fig,  1,  the  outputs  of  the  FDI 
system  are  not  integrated  with  the  control  system  in  the  present 
work.  The  integration  of  these  systems  for  fault  accommodation 
purposes  will  be  pursued  in  future  work.  In  the  following 
sections,  the  design  approach  for  the  FDI  system  is  discussed  in 
detail. 
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Kalman  Filter  Design  for  Sensor  Fault  Detection 

The  Kalman  filter  design  approach  is  based  on  the  linear 
model  representation  of  a  plant.  The  linearized  engine  model 
under  consideration  is  represented  by  the  following  state  space 
equations: 

X  =  A(x - xss )  +  L(h - href )  +  B(ucnld  -uss)+  Bb 

y~y*s  =c(x-xss)  +  M(h-hrqf)+D(ucmd-uss)+Db  +  v  (1) 

where  the  vectors  x,  h,  uard  represent  state  variables,  health 
parameters,  and  control  commands,  respectively.  The  subscript 
“ss”  indicates  the  steady-state  point  (or  the  base  point  at  which 
the  model  was  linearized).  The  vector  href  represents  a  reference 
health  condition.  The  sensor  measurement  vector,  y,  is 
corrupted  by  sensor  noise  v.  The  vector  b  represents  the  bias  in 
the  actuation  system;  it  is  zero  when  there  is  no  actuator  bias. 
The  health  parameter  and  bias  vectors  are  unknown  inputs  to 
the  system  that  affect  engine  operation.  The  matrices  A ,  B,  C, 
D,  L,  and  M  have  appropriate  dimensions. 

For  sensor  fault  detection,  m  Kalman  filters  are  designed 
where  m  is  the  number  of  sensors  being  monitored.  Each 
Kalman  filter  estimates  the  state  vector  using  a  unique  set  of 
(m-1)  sensors.  The  sensor  which  is  not  used  by  a  particular 
filter  is  assumed  to  be  the  potentially  faulty  one  (fault 
hypothesis)  and  thus  monitored  by  that  filter.  For  instance,  the 
t  filter  uses  the  sensor  subset  y  that  excludes  the  t  sensor, 
where  i  is  an  integer  from  1  to  m.  When  the  t  sensor  is  faulty, 
all  Kalman  filters  use  faulty  information  except  for  the  t  filter. 
Consequently,  the  ih  filter  is  able  to  accurately  estimate  the 
state  vector  from  fault-free  sensor  measurements,  whereas  the 
estimates  of  the  remaining  filters  are  distorted  by  the  faulty 
sensor  measurement.  The  Kalman  filter  equation  that  monitors 
the  t  sensor  is  given  as  follows: 

x  =  A(x-  xss )  +  B(ucmd  -  uss  )  +  Kl  (y 1  -  ) 

y  ~  y ss  —C{x— ) + d  (ucmd  —  uss ) 

where  x  and  y1  are  the  estimates  of  the  state  vector  and  the  t 

sensor-subset  vector,  respectively.  The  matrices  Cl  and  Dl 
are  a  subset  of  C  and  D ,  respectively,  with  the  t  row  deleted, 
and  Kl  is  a  Kalman  gain  matrix  corresponding  to  the  matrix 
pair  (A,Cl).  In  order  for  the  Kalman  filter  to  converge,  the 

matrix  pair  (A,  Cl )  must  be  observable. 

The  accuracy  of  the  estimated  state  variables  is  indicated 
by  a  weighted  sum  of  squared  residuals  (WSSR)  which  is 
computed  as  follows: 


WSSR1  =(/'  -j>'y  (STV  -?*)  (3) 


where 

Z*  =diag[o-i]2 

The  vector  a1  represents  the  standard  deviation  of  the  ih 
sensor-subset.  The  square  matrix  normalizes  the  residual 
vector  (yl-yl).  The  value  of  the  fault  indicator  signal, 

WSSR,  increases  if  the  sensor  subset  used  by  a  Kalman  filter 
contains  a  faulty  measurement.  In  order  to  detect  an  anomaly 
in  the  sensor  set,  the  fault  indicator  signals  are  compared 
against  pre-established  detection  thresholds.  If  all  fault 
indicator  signals  except  one  exceed  the  threshold,  it  indicates 
that  the  Kalman  filter  whose  fault  indicator  signal  did  not 
exceed  the  threshold  is  the  one  with  the  correct  fault 
hypothesis.  Consequently,  this  filter  is  isolated,  and  the  sensor 
excluded  by  this  filter  is  identified  as  the  faulty  one. 

It  should  be  noted  that  the  Kalman  filter  in  eq.  (2)  does  not 
account  for  the  influence  of  health  parameters  or  actuator  biases 
that  appear  in  eq.  (1).  Therefore,  any  deviations  of  these 
parameters  from  the  design  point  can  cause  an  increase  in  the 
values  of  the  fault  indicator  signals.  Depending  on  their 
magnitude,  such  deviations  may  induce  a  fault  misclassification 
scenario  where  all  fault  indicator  signals  except  one  exceed  the 
detection  threshold.  To  avoid  such  scenarios,  additional 
features  that  account  for  health  parameter  and  actuator  bias 
deviations  must  be  built  into  the  FDI  system.  For  the  health 
parameters,  two  possible  deviation  types  need  to  be  considered: 
1)  gradual  degradation  due  to  aging,  and  2)  abrupt  degradation 
due  to  component  faults.  An  approach  to  deal  with  the  gradual 
degradation  was  discussed  in  reference  [2].  That  is,  estimate  all 
health  parameters  once  per  a  number  of  flights  using  ground- 
based  trend  monitoring  techniques  [3,4,5],  update  the  reference 
health  condition  (hreJ)  and  the  linear  engine  model  in  eq.  (1),  and 
then  update  the  Kalman  filter.  As  long  as  this  updated 
reference  health  condition  remains  close  enough  to  the  actual 
condition  (which  continues  to  degrade  with  time),  the 
interference  of  the  gradual  degradation  on  the  Kalman  filters 
designed  through  eq.  (2)  will  remain  small.  Abrupt  degradation 
(A h=h-href  in  eq.  1)  due  to  component  faults  or  actuator  bias 
needs  to  be  handled  by  other  means.  The  approach  taken  in  this 
paper  is  to  design  another  Kalman  filter  which  assumes  that 
components  and/or  actuators  may  be  faulty.  If  this  filter  is  able 
to  maintain  low  residual  values  in  the  case  of  component  and/or 
actuator  faults,  misclassifications  of  these  faults  as  a  sensor 
fault  may  be  avoided.  The  design  of  this  additional  Kalman 
filter  is  discussed  in  the  following  section. 


Kalman  Filter  Design  for  Component  and  Actuator 
Fault  Detection 

Ideally,  a  Kalman  filter  which  is  capable  of  accurately 
estimating  all  health  parameters  is  desirable.  Such  a  filter 
would  be  able  to  maintain  accurate  sensor  estimation  (and  thus 
low  residuals)  even  in  the  presence  of  component  faults. 
However,  the  number  of  health  parameters  that  can  be 
estimated  is  limited  to  the  number  of  available  sensors  [6]. 
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Aircraft  engines  have  a  limited  number  of  sensors  which  is,  in 
general,  less  than  the  number  of  health  parameters.  Therefore, 
estimating  all  health  parameters  is  not  realistic.  An  alternative 
approach,  which  can  meet  the  aforementioned  objective  while 
using  a  limited  number  of  sensors,  is  to  estimate  a  subset  of 
health  parameters.  In  reference  [2],  it  was  observed  that  the 
Kalman  filter,  designed  with  a  subset  of  health  parameters, 
could  retain  accurate  estimation  of  sensor  outputs  when  applied 
to  a  “degraded”  engine  simulation.  The  accuracy  of  the 
estimated  health  parameters,  however,  was  poor  as  the  Kalman 
filter  attributed  the  steady-state  mismatch  caused  by  health 
degradation  to  the  subset  of  health  parameters  being  estimated. 
Therefore,  the  estimated  health  parameters  no  longer  indicate 
the  actual  health  condition,  but  instead,  they  are  “tuning” 
parameters  that  the  Kalman  filter  can  use  to  generate  accurate 
sensor  estimates.  This  concept  of  “tuning”  is  applied  to  the 
design  of  a  Kalman  filter  in  this  section.  The  idea  is  to  use 
tuning  parameters  (a  subset  of  health  parameters)  with  which 
the  Kalman  filter  can  maintain  good  sensor  estimation 
performance  no  matter  what  combination  of  health  parameters 
is  shifted  from  their  reference  point.  The  Kalman  filter 
equation  that  incorporates  the  tuning  parameters  is  given  as 
follows: 


x  ~ 

*aug 
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0  0 
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WSSR  =  (y-y)r(E)-l(y-y)  (5) 


where 


Z  =  diag[af 

The  vector  a  represents  the  standard  deviation  of  the  sensor 
set.  It  should  be  noted  that  this  filter  uses  all  sensors  of  the 
given  sensor  suite.  The  assumption  of  this  filter  is  that  all 
sensors  are  healthy  and  that  components  are  potentially  faulty 
(fault  hypothesis). 

The  fault  indicator  signal  of  this  filter  must  meet  two 
requirements:  1)  it  must  remain  small  in  the  case  of  component 
faults  and  2)  it  must  increase  in  the  case  of  a  sensor  fault. 
These  two  conditions  are  required  to  indicate  whether  the  fault 
hypothesis  of  this  filter  is  correct  or  incorrect.  It  was  found  that 
this  WSSR  could  meet  the  first  condition,  but  not  the  second 
one.  In  the  case  of  a  sensor  fault,  the  WSSR  could  remain  small 
depending  on  which  sensor  is  faulty.  After  some  investigation, 
it  was  found  that,  whenever  the  WSSR  remains  small  in  the 
presence  of  a  faulty  sensor,  the  sensor  fault  is  attributed  to  the 
engine  internal  condition:  the  tuning  parameters.  In  other 
words,  the  Kalman  filter  tries  to  “explain”  a  sensor  fault  by 
shifting  the  tuning  parameters.  If  it  is  successful  in  doing  so, 
the  value  of  WSSR  remains  small. 

To  address  this  shortcoming,  another  fault  indicator  signal 
is  used.  This  signal,  a  weighted  sum  of  squared  tuners 
(WSST),  is  computed  as  follows: 


where 
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The  vector  d  contains  the  tuning  parameters.  The  matrices  Ld 
and  Md  are  selected  columns  of  L  and  M,  respectively,  and  their 
columns  correspond  to  the  tuning  parameters.  As  discussed 
earlier,  all  health  parameters  gradually  deviate  from  the  healthy 
baseline.  This  deviation  is  called  “baseline  degradation”  (href  in 
eq.  1)  and  can  be  tracked  by  ground-based  trend  monitoring 
techniques  once  per  a  number  of  flights.  As  the  gradual 
degradation  progresses,  all  Kalman  filters  need  to  be  updated* 
based  on  the  estimated  baseline  degradation  so  that  the  Kalman 
filters  will  operate  within  the  linear  range  of  a  degraded  engine. 
The  tuning  parameters  are  the  deviation  values  from  this 
updated  reference  point. 

Similar  to  the  Kalman  filters  designed  for  sensor  fault 
detection,  the  accuracy  of  the  estimated  sensor  measurements  is 
indicated  by  a  weighted  sum  of  squared  residuals  (WSSR) 
which  is  computed  as  follows: 


*  It  is  desirable  to  update  both  state-space  matrices  and  steady-state  points. 
If  this  is  not  achievable,  then  at  least  the  steady-state  points  must  be  updated, 
while  maintaining  the  state-space  matrices  obtained  at  the  healthy  baseline 
condition. 


WSST  =  Wd(dTd)  (6) 

where  W d  is  a  designer  selected  weighting  factor.  Regardless 

of  the  fault  type,  the  value  of  WSST  increases  when  a  fault 
occurs.  However,  the  following  two  conditions  were  observed: 
1)  the  increase  in  WSST  is  generally  small  in  the  component 
fault  case,  and  2)  the  increase  in  WSST  becomes  excessively 
large  whenever  this  Kalman  filter  maintains  a  low  WSSR  value 
in  the  presence  of  a  faulty  sensor.  Based  on  these  observations, 
the  two  fault  indicator  signals  (WSSR  and  WSST)  are  used  in 
combination  to  indicate  whether  the  fault  hypothesis  of  this 
filter  is  correct  or  incorrect.  If  both  signals  remain  below  their 
detection  thresholds,  the  fault  hypothesis  is  correct,  i.e., 
component  faults  may  exist  but  all  sensors  are  healthy.  If  at 
least  one  of  them  exceeds  the  detection  threshold,  the  fault 
hypothesis  is  incorrect,  and  thus  a  sensor  fault  is  believed  to 
exist.  Through  this  approach,  sensor  and  component  faults  can 
be  distinguished.  It  should  be  noted  that  as  the  magnitude  of  a 
component  fault  increases,  the  value  of  WSST  increases  and 
eventually  exceeds  the  detection  threshold.  By  the  time  this 
happens,  it  is  expected  that  each  fault  indicator  signal  generated 
for  sensor  fault  detection  would  already  have  exceeded  its 
threshold  so  that  misclassifications  of  component  faults  as  a 
sensor  fault  will  be  avoided. 

So  far,  only  the  component  fault  case  has  been  discussed  in 
this  section.  Actuator  faults  can  be  handled  by  either 
augmenting  the  tuning  parameter  vector  in  eq.  (4)  with  the 
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actuator  bias  term  in  eq.  (1)  or  designing  single  Kalman  filters 
for  each  of  the  actuators  as  was  done  in  reference  [2]. 
However,  a  different  approach  is  taken  in  this  paper.  When  an 
actuator  is  biased,  it  causes  a  measurement  shift  in  multiple 
sensors,  similar  to  the  component  fault  case.  The  Kalman  filter 
designed  with  tuning  parameters  can  handle  such  multiple 
measurement  shifts  and,  therefore,  is  considered  to  have  some 
robustness  to  actuator  faults  as  well,  i.e.,  the  two  fault  indicator 
signals  will  remain  small  when  actuators  are  faulty.  Therefore, 
the  Kalman  filter  with  tuning  parameters  is  used  to  detect  both 
component  and  actuator  faults.  If  this  filter  is  not  robust  to 
actuator  faults,  then  the  designer  must  take  one  of  the 
aforementioned  approaches  to  meet  design  objectives. 

It  should  be  noted  that,  when  the  Kalman  filter  with  tuning 
parameters  is  isolated  from  the  rest  of  the  filters,  the  specific 
component(s)  and/or  actuator(s)  which  are  faulty  are  not 
identified.  For  further  diagnosis  of  the  component  and  actuator 
faults,  another  set  of  Kalman  filters,  each  designed  for  a 
specific  fault  event  (such  as  foreign  object  damage,  domestic 
object  damage,  fuel  system  failure,  etc.),  may  be  used.  Since  it 
is  already  known  that  a  fault  exists,  a  detection  threshold  is  not 
needed.  Instead,  by  ranking  the  likelihood  of  plausible  faults 
based  on  the  Kalman  filter  estimation  accuracy,  the  possibility 
of  misclassifications  may  be  reduced.  This  process  was 
demonstrated  by  Volponi  et  al.  [7],  and  a  high  success  rate  was 
exhibited. 


Overall  Sensor  FDI  Architecture 

The  overall  architecture  of  the  sensor  FDI  system  is  shown 
in  fig.  2.  The  FDI  system  is  composed  of  a  bank  of  (m+1) 
Kalman  filters  where  m  is  the  number  of  sensors  being 
monitored.  Kalman  filters  1  through  m  are  used  to  detect 
sensor  faults  while  the  (m+ 1)*  Kalman  filter  is  used  for  the 
detection  of  component/actuator  faults.  With  this  bank  of 
Kalman  filters,  the  following  assumptions  are  made: 

•  Only  one  sensor  may  fail  at  a  time. 

•  Multiple  components  and  actuators  may  fail  at  a  time. 

•  Only  one  of  the  above  two  types  of  failures  may  occur 
at  a  time. 


=> 

•  No  Fault 

or 

•  Fault  Detected 

or 

•  Fault  Isolated 


y  Ucmd 


Figure  2.  Architecture  of  the  Sensor  FDI  System 


In  the  fault  isolation  process,  the  fault  indicator  signal 
generated  by  each  Kalman  filter  is  compared  against  a  pre¬ 
defined  detection  threshold.  If  a  fault  indicator  signal  exceeds 
the  threshold,  it  indicates  that  the  corresponding  Kalman  filter 
is  using  an  incorrect  fault  hypothesis.  The. Kalman  filter 
#(m*f  1)  generates  two  fault  indicator  signals,  and  at  least  one  of 
them  must  exceed  the  threshold  to  indicate  that  its  fault 
hypothesis  is  incorrect. 

Table  1  summarizes  the  fault  isolation  process.  There  are 
eight  possible  scenarios,  as  enumerated  in  table  1,  that  the  fault 
isolation  process  may  encounter.  When  sensors,  actuators,  and 
components  are  all  nominal,  all  fault  indicator  signals  will 
remain  below  their  thresholds,  indicating  that  no  fault  exists  in 
the  system  (scenario  1).  When  a  fault  occurs,  the  value  of  each 
fault  indicator  signal  except  for  the  one  with  the  correct 
hypothesis  will  increase.  The  increased  amount  will  vary  for 
each  fault  indicator  signal  as  each  filter  has  a  different  response 
or  sensitivity  to  a  particular  fault.  Depending  on  the  type  and 
severity  of  the  fault,  some  fault  indicator  signals  may  exceed 
their  thresholds  while  others  may  remain  below.  If  at  least  one 


Table  1.  Summary  o 

Fault  Isolation  Process 

WSSR'”*"  and  WSST  for  Kalman  Filter  #(m+l) 
(Component  and/or  Actuator  Fault  Hypothesis  Filter) 

Both  remain  below 
threshold 

Either  one  or  both  exceed 
threshold 

WSSR' 

for  Kalman 
filters  #1  ~#m 
(Sensor  Fault 
Hypothesis 
Filters) 

All  WSSRs  remain  below  threshold 

1)  No  fault  exists 

2)  Detection  of  fault 
(no  isolation) 

At  least  one  WSSR  exceeds 
threshold  and  at  least  two  WSSRs 
remain  below  threshold 

3)  Detection  of  fault 
(no  isolation) 

4)  Detection  of  fault 
(no  isolation) 

All  but  one  WSSR  exceed  threshold 

5)  Detection  of  fault 
(no  isolation) 

6)  Detection  and  isolation 
of  sensor  fault 

All  WSSRs  exceed  threshold 

7)  Detection  of 
component/actuator  fault 

8)  Detection  of  large 
component/actuator  fault 
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fault  indicator  signal  exceeds  its  threshold,  the  fault  isolation 
process  declares  that  a  fault  was  detected.  However*  the 
isolation  of  a  fault  can  not  be  achieved  as  long  as  at  least  two 
Kalman  filters  do  not  have  a  threshold  violation.  Scenarios  2 
through  5  represent  these  cases  where  a  fault  can  he  detected 
but  not  isolated.  When  a  threshold  violation  occurs  for  all 
Kalman  filters  except  one,  then  this  single  Kalman  filter  is 
isolated  from  the  rest,  and  the  fault  hypothesis  used  by  this 
filter  reveals  the  identity  of  the  fault  Thus,  the  isolation  of  a 
sensor  fault  is  achieved  in  scenario  6,  and  the  detection  of  a 
component/actuator  fault  is  achieved  in  scenario  7.  Finally,  as 
discussed  earlier,  when  a  threshold  violation  occurs  for  all 
Kalman  filters,  the  fault  isolation  process  declares  that  a  large 
component/actuator  fault  has  occurred  (scenario  8). 


APPLICATION  OF  FD1  METHODOLOGY  TO  AN 
AIRCRAFT  ENGINE  SIMULATION 

In  this  section,  the  FDI  design  methodology  is  applied  to 
an  aircraft  engine  simulation.  A  description  of  the  engine 
simulation  is  given  first.  From  the  engine  simulation,  piecewise 
linear  models  are  generated  along  the  steady-state  power  setting 
line  at  a  cruise  condition.  Based  on  these  linear  models,  the 
piecewise  Kalman  filter  model  is  developed  in  order  to  cover 
multiple  power  settings. 


Engine  Model 

The  engine  model  used  in  this  paper  is  a  nonlinear 
simulation  of  an  advanced  high-hypass  turbofan  engine.  This 
engine  is  constructed  as  a  Component  Level  Model  (CLM), 
which  assembles  the  following  five  major  components  of  an 
aircraft  engine:  Fan  (FAN),  Booster  (BST),  High-Pressure 
Compressor  (HPC),  High-Pressure  Turbine  (HPT),  and  Low- 
Pressure  Turbine  (LPT).  The  health  parameters,  which 
represent  the  component  performance  deterioration,  are 
adjustments  to  efficiency  and  flow  capacity  scalars  of  the  above 
five  components.  The  current  version  of  the  simulation  does 
not  have  health  parameters  for  the  combustor.  The  engine  state 
variables,  health  parameters,  actuation  variables,  and  sensor 
measurements  are  shown  in  table  2. 

The  outputs  of  the  seven  sensors  in  table  2  are  fed  into  the 
digital  engine  control  unit.  At  the  cruise  operating  condition 
evaluated  in  this  study,  the  power  lever  angle  (PLA)  value  is 


Table  2,  State,  Health,  Actuator,  and  Sensor  Variables 


State  Variables 

XNL,  XNH,  TMHS23,  TMHS3,  TMHSBL 
TMHSBC,  TMHS41,  TMHS42,  TMHS5 

Health 

Parameters 

FAN  efficiency,  FAN  flow  capacity 

BST  efficiency,  BST  flow  capacity 

HPC  efficiency,  HPC  flow  capacity 

HPT  efficiency,  HPT  flow  capacity 

LPT  efficiency,  LPT  flow  capacity 

Actuators 

WF36,  VBV,  VSV 

Sensors 

XN12,  XN25,  P25,  T25,  PS3,  T3,  T49 

converted  to  the  desired  corrected  low-pressure  spool  speed  (an 
indicator  of  thrust).  The  control  system  adjusts  three  actuation 
variables  to  cause  the  corrected  measured  low-pressure  spool 
speed  value  to  match  the  commanded  value.  PLA  varies  from 
38  to  72  degrees. 

The  standard  deviations  of  the  sensor  noise  used  in  this 
paper  are  shown  in  table  3.  The  values  are  given  in  percent  of 
the  steady-state  values  at  the  maximum  power  setting 
(PLA=72). 


Table  3,  Sensor  Noise  Standard  Deviation  in  %  of  the 


Trim  Values  at  l\ 

Maximum  Power 

Sensor 

a 

XN12 

0.25 

XN25 

0.25 

P25 

0.50 

T25 

0.75 

PS3 

0.50 

T3 

0.75 

T49 

0.75 

Piecewise  Kalman  Filter  Model 

At  the  selected  cruise  condition,  piecewise  linear  engine 
models  are  generated  along  the  steady-state  power  setting  line 
where  PLA  varies  from  38  to  72  degrees.  A  linear  engine 
model  is  composed  of  trim  values  and  state  space  matrices.  For 
each  of  these  linear  models,  a  Kalman  gain  is  computed.  Then, 
the  piecewise  Kalman  filter  model  is  developed  by  linking  the 
piecewise  linear  models  and  the  corresponding  Kalman  gains. 
The  architecture  of  the  piecewise  Kalman  filter  model  is  shown 
in  fig.  3. 

The  piecewise  Kalman  filter  model  is  composed  of  the 
steady-state  (base-point)  model,  state-space  matrices,  and 
Kalman  gains.  The  steady-state  model  captures  nonlinear 
engine  characteristics  along  the  power  setting  line,  while  the 
state-space  matrices  (dynamic  model)  capture  off-nominal 
engine  behavior  due  to  perturbations  from  the  steady-state  line. 
These  three  elements  of  the  Kalman  filter  model  are  saved  in 
table  lookup  form.  For  a  given  set  of  two  input  signals  (ucmdt  y), 
the  steady-state  values,  the  state-space  matrices,  and  a  Kalman 
gain  constitute  the  Kalman  filter  equation,  by  which  the  state 
variables  and  sensor  outputs  are  estimated.  As  PLA  moves 
from  one  point  to  another,  those  elements  saved  in  the  lookup 
table  are  interpolated  linearly  based  on  a  scheduling  parameter. 
In  the  current  model,  the  estimated  low-pressure  spool  speed 
(XN12)  is  used  as  the  scheduling  parameter.  It  should  be  noted 
that  the  scheduling  parameter  can  be  a  function  of  multiple 
parameters  as  in  references  [1,8].  More  detailed  discussion 
regarding  the  piecewise  linear  state  variable  model  can  be 
found  in  references  [8,9]. 

By  using  the  architecture  of  fig.  3,  a  piecewise  Kalman 
filter  model  is  built  for  each  fault  hypothesis  (eqs.  2  and  4),  and 
a  bank  of  Kalman  filters  is  formed  as  shown  in  fig.  2.  The  FDI 
system  is  now  able  to  cover  the  full  PLA  range  at  a  fixed 
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Figure  3.  Architecture  of  Piecewise  Kalman 
Filter  Model 

ambient  condition  of  the  selected  cruise  point.  In  order  to 
expand  the  range  of  ambient  conditions  over  which  the  FDI 
system  can  operate,  the  parameters  of  the  Kalman  filters  must 
be  corrected  based  on  inlet  condition,  however,  this  additional 
step  is  not  pursued  in  this  paper. 


Selection  of  Tuning  Parameters 

The  selection  of  the  tuning  parameters  for  designing  the 
(m+l)st  Kalman  filter  is  critical  in  order  to  achieve  overall 
sensor  FDI  performance  at  an  acceptable  level.  It  is  desirable 
to  have  some  optimal  selection  methods;  however,  the  tuning 
parameters  used  in  this  paper  were  selected  by  trial  and  error. 
The  selected  tuning  parameters  are:  FAN  flow  capacity,  BST 
flow  capacity,  HPC  efficiency,  HPC  flow  capacity,  HPT  flow 
capacity,  and  LPT  flow  capacity.  With  these  tuning  parameters, 
the  Kalman  filter  is  able  to  accurately  estimate  sensor  outputs 
even  if  all  10  health  parameters  are  shifted  from  a  reference 
point.  Again,  it  should  be  remembered  that  the  tuning 
parameters  do  not  indicate  the  actual  health  condition  although 
they  are  selected  from  the  health  parameters. 


Modifications  to  the  FDI  System 

During  the  preliminary  evaluation  of  the  FDI  system,  it 
was  found  that  the  Kalman  filter  design  approach  for  the  fault 
detection  of  the  XN25  and  T25  sensors  had  to  be  modified. 
When  either  of  these  sensors  is  biased,  the  control  system 
generates  a  large  off-nominal  variable  stator  vane  (VSV) 
command.  As  discussed  earlier,  piecewise  linear  models  are 
generated  along  the  steady-state  power  setting  line.  Any  control 
input  deviation  from  this  steady-state  line  is  the  delta  input  to 
the  linear  models.  Under  normal  fault- free  engine  operation, 
any  control  input  deltas  remain  relatively  small,  and  therefore 
the  linear  models  are  valid  to  describe  the  off-nominal  engine 
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behavior.  However,  when  one  of  the  aforementioned  two 
sensors  is  biased,  the  engine  operates  at  a  condition  where  the 
steady-state  VSV  command  is  significantly  shifted  from  its 
nominal  value.  This  large  shift,  used  as  an  input  to  linear 
model,  exceeds  the  linear  range  and  gives  the  appearance  that 
VSV  is  biased.  The  assumption  of  the  bank  of  Kalman  filters 
for  sensor  FDI  is  that  at  most  one  sensor  is  faulty  while  the 
others,  including  the  actuators,  remain  at  their  nominal 
condition.  Therefore,  with  the  large  shift  in  the  VSV  command 
input,  the  Kalman  filters  designed  for  monitoring  XN25  and 
T25  are  not  able  to  accurately  estimate  state  variables  and 
sensor  outputs,  and  consequently  a  large  fault  indicator  signal  is 
generated.  In  the  meantime,  the  Kalman  filter  designed  with 
tuning  parameters  is  able  to  generate  low  fault  indicator  signals 
since  this  filter  can  handle  the  shifts  in  multiple  parameters. 
Thus,  without  modifications,  the  FDI  system  will  misclassify 
XN25  or  T25  sensor  faults  as  the  component/actuator  fault 
case. 

To  address  this  problem,  the  Kalman  filters  for  the  XN25 
and  T25  sensors  are  designed  based  on  the  augmented  state 
vector  which  is  composed  of  the  state  vector  and  the  VSV  bias 
term.  This  approach,  which  was  used  in  reference  [2],  allows 
the  Kalman  filters  to  estimate  a  bias  in  VSV.  When  a  large  off- 
nominal  steady-state  VSV  value  is  commanded,  the  Kalman 
filters  attribute  this  large  input  to  the  estimated  VSV  bias.  With 
this  modification,  the  effect  of  a  large  command  input  that 
corrupts  the  estimation  of  these  Kalman  filters  is  reduced,  and 
therefore  the  sensor  outputs  are  accurately  estimated.  The 
problem  of  a  large  off-nominal  shift  in  the  VSV  command  is 
specific  to  the  control  system  used  in  the  current  study.  If  a 
different  control  design  is  employed,  this  problem  may  not  be 
encountered;  instead,  new  challenges  may  appear. 


PERFORMANCE  EVALUATION  OF  THE  SENSOR  FDI 
SYSTEM 

In  this  section,  the  FDI  system  is  evaluated  at  three  PLA 
settings:  50,  60  and  68  degrees.  As  discussed  earlier,  the  three 
objectives  of  sensor  FDI  are  to  avoid  1)  missed  detections,  2) 
false  alarms,  and  3)  misclassifications.  The  evaluation  is  based 
on  each  of  these  objective  categories.  Additionally,  the 
robustness  of  the  FDI  system  is  evaluated. 


Evaluation  1 :  Missed  Detections 

When  a  single  sensor  is  faulty,  it  must  be  correctly 
detected  and  isolated.  If  this  objective  is  not  achieved,  it  is 
considered  that  the  FDI  system  missed  the  detection  of  the 
sensor  fault.  To  assess  the  missed  detection  rate  generated  by 
the  FDI  system,  it  is  desirable  to  have  design  specifications 
which  define  the  bias  magnitude  at  which  sensors  transition 
from  “nominal”  to  “faulty”  operation.  Since  such  information 
is  not  available  in  this  study,  the  minimum  sensor  bias  that  the 
proposed  FDI  system  can  isolate  is  determined  for  each  of  the 
sensors.  If  design  specifications  are  available,  the  FDI  system, 
or  specifically  the  detection  thresholds,  may  be  adjusted  to 
meet  a  desired  performance  level. 


Table  4  shows  the  minimum  positive  bias  in  each  sensor 
that  could  be  isolated  by  the  FDI  system  at  the  three  power 
settings  considered.  The  numbers  are  given  in  percent  of  the 
steady-state  values  at  the  maximum  powfer  setting  (PLA=72). 
All  sensor  biases  of  these  magnitudes  were  isolated  correctly. 
The  magnitude  of  the  minimum  isolated  bias  varies  with  sensor 
type  and  also  with  power  setting.  This  variation  in  the 
magnitude  depends  on  how  easily  the  “correct”  Kalman  filter 
can  be  isolated  from  the  rest  of  the  filters.  For  most  of  the  test 
cases,  the  fault  indicator  signal  which  exceeded  the  threshold 
last  (the  correct  one  must  remain  below  the  threshold)  is  the 
one  corresponding  to  the  Kalman  filter  with  tuning  parameters. 
Therefore,  overall  sensor  isolation  performance  of  the  FDI 
system  depends  not  only  on  the  sensor  suite  but  also  the 
selection  of  tuning  parameters.  The  worst  case,  or  the  largest 
minimum  bias  value  that  could  be  isolated,  is  die  6.7%  PS3 
sensor  bias.  If  the  isolation  of  smaller  magnitude  faults  is 
desired,  the  detection  thresholds  must  be  set  lower.  However, 
this  adjustment  may  result  in  increased  false  alarms  and 
misclassifieations. 

When  PLA  is  moved  beyond  the  value  of  68  degrees,  it 
becomes  very  difficult  to  isolate  XN25  sensor  bias.  As 
mentioned,  bias  in  this  sensor  causes  a  large  off-nominal  shift 
in  the  steady-state  VSV  command  input.  Similarly,  the  off- 
nominal  steady-state  shift  in  the  WF36  command  input 
increases  as  PLA  increases.  When  PLA  exceeds  68,  this  off- 
nominal  WF36  shift  becomes  too  large  for  the  linear  model  to 
handle.  As  a  result,  XN25  sensor  bias  is  diagnosed  as  a 
component/actuator  fault  by  the  FDI  system.  This  problem 
may  be  solved  by  augmenting  the  state  vector  with  a  WF36  bias 
term  as  was  done  for  the  VSV  input.  However,  this  further  step 
has  not  been  taken  in  this  work. 


Table  4.  Minimum  Positive  Bias  Isolated  by  the 
Sensor  FDI  System 

(%  of  Steady-State  Value  at  Maximum  Power) 


PLA=50 

PLA=60 

PLA=68 

XN12 

1.6 

1.9 

2.1 

XN25 

4.7 

4,0 

3.4 

P25 

2.9 

3.5 

5.0 

T25 

2.1 

2.0 

2.0 

PS3 

3.2 

5.1 

6.7 

T3 

2.8 

3.5 

4.1 

T49 

2.3 

2.9 

3,2 

Evaluation  2:  False  Alarms 

When  the  FDI  system  is  applied  to  a  real  engine,  non-fault- 
related  factors  which  exist  in  the  real  environment,  such  as 
sensor  noise  and  modeling  uncertainty,  should  not  be  diagnosed 
as  a  sensor  fault.  If  this  happens,  the  FDI  system  will  have 
generated  a  false  alarm.  Since  the  Kalman  filter  design 
approach  accounts  for  these  non-fault-related  factors  to  some 
degree,  the  estimator  should  handle  them  well  as  long  as  they 
do  not  deviate  significantly  from  their  assumed  values. 

In  the  previous  evaluation  step,  the  FDI  system  was 
applied  to  the  nonlinear  engine  simulation  at  three  different 


power  settings.  When  there  was  no  sensor  bias,  no  false  alarm 
was  generated.  This  means  that  the  Kalman  filters  are  able  to 
handle  the  given  sensor  noise  (table  3)  and  the  model  mismatch 
that  exists  between  the  nonlinear  engine  simulation  and  its 
linear  representation.  In  this  section,  the  robustness  of  the  FDI 
system  to  sensor  noise  and  modeling  uncertainty  is  evaluated 
by  varying  the  magnitude  of  these  factors. 

At  the  steady-state  condition  of  the  three  power  settings 
used  in  the  previous  section,  either  the  sensor  noise  level  or  the 
model  uncertainty  level  is  increased.  By  increasing  these 
factors,  the  FDI  system  may  eventually  generate  a  false  alarm 
(only  one  fault  indicator  signal  remaining  below  the  detection 
threshold).  In  this  study,  however,  the  level  of  sensor  noise  and 
model  uncertainty  is  Increased  up  to  the  initial  point  of  fault 
detection  where  the  threshold  is  just  exceeded  by  at  least  one 
fault  indicator  signal.  If  the  FDI  system  can  tolerate  a  large 
magnitude  increase  in  these  factors,  it  is  considered  that  the 
likelihood  of  generating  false  alarms  is  very  small. 

In  the  simulation,  the  sensor  noise  Is  increased  by 
multiplying  the  standard  deviation  (table  3)  by  a  scale  factor. 
Model  uncertainty  is  introduced  by  shifting  all  10  health 
parameters  of  the  nonlinear  engine  simulation  by  the  same 
amount  from  the  healthy  baseline.  Since  the  FDI  system  was 
designed  based  on  a  “healthy”  engine,  the  outputs  of  the 
“degraded”  nonlinear  engine  simulation  deviate  from  the  design 
point  of  the  FDI  system.  Table  5  shows  the  level  of  sensor 
noise  scale  factor  and  model  uncertainty  (steady-state  model 
mismatch)  that  the  FDI  system  can  tolerate,  i.e.,  all  fault 
indicator  signals  remain  below  the  threshold.  The  noise  scale 
factor  was  increased  by  1%  increments  while  the  steady-state 
model  mismatch  was  increased  by  0.1%  increments  to  obtain 
these  results.  When  the  level  of  either  one  of  these  two  factors 
is  increased,  the  other  was  kept  at  the  nominal  design  condition. 

As  the  noise  scale  factor  was  increased,  the  values  of  all 
WSSR  signals  increased  even  though  the  Kalman  filters  could 
maintain  good  estimation  accuracy  of  sensor  outputs.  This 
increase  is  due  to  the  fact  that  the  normalization  factor  (E  in 
eqs.  3  and  5)  used  to  generate  WSSR  is  based  on  the  assumed 
noise  intensity.  Noise  that  exists  in  the  real  environment  is 
never  certain.  Therefore,  the  detection  threshold  has  been 
selected  to  account  for  the  uncertainty  in  noise  statistics.  The 
FDI  system  can  tolerate,  at  worst,  a  9%  (at  PLA-50)  noise 
increase.  If  this  value  is  considered  too  small,  then  the 
detection  threshold  must  be  increased  accordingly. 

Similarly,  the  fault  indicator  signals  increase  as  the  level  of 
steady-state  model  mismatch  is  increased.  Model  mismatch 
causes  a  shift  in  all  sensor  measurements  from  the  reference 
point,  as  If  small  biases  were  injected  into  all  sensors.  Since 
the  Kalman  filter  assumes  that  the  sensor  outputs  are  corrupted 
only  by  white  noise,  it  is  not  able  to  maintain  good  estimation 
accuracy  when  model  mismatch  is  present.  The  variation  in 
fault  indicator  signals  due  to  model  mismatch  must  be 
accounted  for  in  threshold  selection.  The  FDI  system  can 
tolerate,  at  worst,  a  0.3%  (at  PLA=68)  shift  in  all  health 
parameters.  Again,  if  this  value  is  considered  too  small,  then 
the  detection  threshold  must  be  increased  accordingly. 
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Table  5.  Non-Fault-Related  Factors  Tolerated  by  the 


FDI  Si 

/stem 

PLA=50 

PLA=60 

PLA=68 

Noise 

Factor 

9% 

11% 

13% 

Model 

Mismatch 

0.7% 

0.4% 

0.3% 

Evaluation  3:  Misclassifications 

A  misclassification  is  an  event  where  the  FDI  system 
correctly  detects  a  fault  that  exists  in  the  engine  but  classifies  it 
as  the  wrong  fault.  For  example,  when  an  anomaly  other  than  a 
sensor  fault  occurs  in  the  aircraft  engine,  the  sensor  FDI  system 
should  not  classify  it  as  a  sensor  fault.  If  it  does,  it  is 
considered  that  the  FDI  system  misclassified  the  fault.  Such 
anomalies  can  occur  to  engine  components  during  flight  due  to 
fault  events  such  as  foreign  or  domestic  object  damage. 
Anomalies  can  also  exist  in  actuators  due  to  mechanical  or 
electrical  failure  in  the  actuation  systems.  In  order  to  avoid 
misclassification,  the  FDI  system  contains  one  additional 
Kalman  filter  designed  with  tuning  parameters  as  discussed 
earlier.  When  components  or  actuators  are  faulty,  the  two  fault 
indicator  signals  (WSSR  and  WSST)  of  this  filter  should  not 
exceed  the  threshold.  If  this  can  be  achieved,  the  FDI  system 
will  not  misclassify  component  or  actuator  faults  as  a  sensor 
fault.  In  this  section,  the  FDI  system  is  evaluated  as  to  whether 
it  can  avoid  misclassifications  of  component  and  actuator 
faults. 

Table  6  shows  the  component/actuator  fault  scenarios  used 
to  evaluate  the  FDI  system  at  the  three  power  settings 
(PLA=50,  60,  68).  For  each  engine  component,  both  efficiency 

Table  6.  Component  and  Actuator  Fault  Scenarios 


for  the  FDI  Performance  Eval 

uation 

Delta  Range 

#  of  Cases 

Single 

FAN 

[1%,  4%] 

50 

Component 

BST 

[1%,  4%] 

50 

Fault 

HPC 

[1%,  4%] 

50 

HPT 

[1%,  3%] 

100 

LPT 

[1%,  3%] 

100 

Multiple 

FAN 

[2%,  4%] 

100 

Component 

BST 

[1%,  3%] 

Fault 

BST 

[2%,  4%] 

100 

HPC 

[1%,  3%] 

FAN 

[2%,  4%] 

100 

BST 

[1%,  3%] 

HPC 

[0.5%,  2%] 

HPT 

[1%,  3%] 

200 

LPT 

[1%,  3%] 

Single  and 

WF36 

5% 

150 

Multiple 

VBV 

5% 

Actuator 

VSV 

5% 

Fault 

and  flow  capacity  are  shifted  randomly  within  the  range  shown 
in  the  table.  This  range  is  considered  to  encompass  any 
reasonable  failure  scenarios.  All  component  shifts  are  made  in 
the  negative  direction,  except  for  HPT  and  LPT  flow  capacities 
which  are  shifted  in  both  positive  and  negative  directions.  The 
actuator  bias  is  also  varied  randomly  in  both  positive  and 
negative  directions  within  the  specified  range.  The  actuator 
bias  range  is  shown  in  percent  of  full-scale  values. 

For  the  3000  test  cases  evaluated  (the  1000  fault  scenarios 
shown  in  table  6  at  each  of  the  three  power  settings),  no 
misclassifications  were  encountered.  This  demonstrates  the 
significant  robustness  of  the  FDI  system  to  component  and 
actuator  faults.  This  robustness  is  largely  due  to  the  Kalman 
filter  with  tuning  parameters.  If  this  filter  is  not  included,  the 
FDI  system  is  more  likely  to  misclassify  faults.  To  verify  this 
claim,  the  FDI  system  was  “standardized”  by  removing  the 
Kalman  filter  with  tuning  parameters  and  then  re-evaluated. 
For  the  1000  fault  scenarios  at  each  of  the  three  power  settings, 
the  number  of  component/actuator  fault  cases  that  this 
“standard”  FDI  system  misclassified  as  a  sensor  fault  were  as 
follows:  97  (PLA=50),  113  (PLA=60),  and  108  (PLA=68). 

During  the  evaluation  of  the  “robust”  FDI  system  (the 
Kalman  filter  with  tuning  parameters  included),  it  was  noted 
that,  in  some  of  the  fault  scenarios,  a  threshold  violation 
occurred  for  all  Kalman  filters.  If  this  happens,  the  FDI  system 
indicates  that  a  large  component/actuator  fault  may  have 
occurred  (see  table  1). 


Evaluation  4:  Robust  Sensor  Isolation 

All  engine  components  gradually  degrade  with  time  due  to 
usage.  As  discussed  earlier,  the  baseline  degradation  (shift  in 
all  health  parameters  from  the  healthy  baseline)  can  be  tracked 
by  ground-based  trend  monitoring  systems,  and  the  estimated 
baseline  degradation  can  be  used  to  update  the  FDI  system  for 
in-flight  fault  diagnostics.  It  is  unlikely  that  the  estimated 
baseline  degradation  will  match  perfectly  with  the  actual 
condition.  In  order  to  assess  the  influence  of  baseline  mismatch 
on  the  sensor  fault  isolation  performance,  the  FDI  system  is 
evaluated  in  the  presence  of  the  error  in  the  estimated  baseline 
degradation. 

In  this  test  case,  the  estimated  baseline  is  set  to  the  healthy 
baseline  condition  (i.e.,  a  trend  monitoring  system  concluding 
that  the  engine  is  healthy),  and  consequently  the  design  of  the 
FDI  system  is  based  on  a  healthy  engine.  This  FDI  system  is 
then  applied  to  the  nonlinear  engine  simulation  with  small 
baseline  degradation.  A  0.3%  shift  is  injected  to  all  10  health 
parameters.  With  this  magnitude,  the  FDI  system  indicates  that 
no  fault  exists  in  the  system  at  the  three  power  settings  (see 
table  5).  In  the  presence  of  this  baseline  degradation  mismatch, 
a  bias  is  injected  into  each  sensor.  Table  7  shows  the  minimum 
positive  bias  isolated  by  the  FDI  system.  Again,  the  numbers 
are  given  in  percent  of  the  steady-state  values  at  the  maximum 
power  setting  (PLA=72). 

All  sensor  biases  were  isolated  correctly,  except  for  one 
case  where  the  XN25  sensor  is  biased  at  a  PLA  setting  of  68 
degrees.  As  discussed  before,  the  isolation  of  the  XN25  sensor 
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is  very  difficult  at  high  power  settings  because  of  the  large  off- 
nominal  shift  in  the  VSV  and  WF36  command  inputs.  As  a 
result,  the  XN25  sensor  bias  is  misclassified  as  a 
component/actuator  fault.  Since  it  is  known  that  the  XN25 
sensor  bias  causes  large  shifts  in  multiple  parameters  (one 
sensor  and  two  actuator  commands),  some  intelligence  must  be 
built  in  to  the  FDI  system  to  account  for  this  knowledge.  In  the 
rest  of  the  scenarios,  the  FDI  system  exhibits  good 
performance.  For  some  sensors,  smaller  bias  can  be  isolated 
compared  to  the  results  shown  in  table  4.  The  worst  case,  or 
the  largest  minimum  bias  value  that  could  be  isolated,  is  the 
6.0%  PS3  sensor  bias.  It  is  especially  encouraging  that  the  FDI 
system  did  not  attribute  a  fault  in  one  sensor  to  a  different 
sensor  which,  if  it  had  occurred,  would  have  created  a  very 
challenging  environment  for  further  accommodation  steps. 


Table  7,  Minimum  Positive  Bias  Isolated  by  the 
Sensor  FDI  System  in  the  Presence  of  0,3%  Baseline 
_  Degradation  Mismatch _ 


PLA=50 

PLA=60 

PLA=68 

XN12 

1.7 

2.1 

2.3 

XN25 

4.3 

3.8 

Misclassification 

P25 

3.0 

3.7 

4.9 

T25 

2.2 

2.1 

2.0 

PS3 

2.8 

4.5 

6.0 

T3 

3.1 

3.9 

4.5 

T49 

1.9 

2.4 

2.7 

DISCUSSION 

In-depth  evaluation  is  a  critical  part  in  the  development  of 
an  in-flight  FDI  system.  The  multiple  objectives  that  the  FDI 
system  must  handle  often  conflict  with  each  other. 
Consequently,  enhancing  one  aspect  of  the  FDI  performance 
does  not  necessarily  result  in  the  enhancement  of  overall 
performance.  For  instance,  the  minimum  sensor  bias 
magnitudes  that  the  FDI  system  can  isolate  may  be  reduced  by 
setting  detection  thresholds  at  a  lower  value.  This  modification, 
however,  may  result  in  increased  false  alarms  and 
misclassifications.  Through  extensive  evaluation,  the  FDI 
system  can  be  matured  to  a  point  where  its  overall  performance 
is  satisfactory.  To  reach  such  a  mature  point,  the  sensor  FDI 
system  developed  in  this  paper  needs  further  evaluation  and 
enhancement.  Some  of  the  issues  that  must  be  addressed  in 
future  work  are  discussed  below. 

First,  the  ambient  conditions  over  which  the  FDI  system 
can  operate  must  be  expanded.  In  the  real  environment,  the 
ambient  condition  continually  changes  even  in  the  cruise  phase. 
As  discussed  earlier,  this  expansion  can  be  accomplished  by 
correcting  the  parameters  of  the  Kalman  filters  based  on  inlet 
pressure  and  temperature  measurements.  In  this  “corrected” 
dimension,  the  FDI  system  must  be  evaluated  for  its  diagnostic 
performance,  sensitivity  to  ambient  condition  changes,  and 
sensitivity  to  inlet  sensor  faults. 


The  evaluation  results  presented  in  this  paper  were 
obtained  at  fixed  PLA  values  or  fixed  target  low-pressure  spool 
speeds  (a  fixed  PLA  value  does  not  necessarily  mean  a  fixed 
steady-state  condition  when  faults  are  present  in  the  system). 
Since  the  PLA  movement  is  expected  to  be  small  in  the  cruise 
phase  of  a  commercial  aircraft,  the  FDI  system  was  developed 
to  be  robust  enough  to  handle  small  PLA  movements,  i.e.,  false 
alarms  are  not  generated  during  minor  transients.  When  the 
FDI  system  operates  under  relatively  large  PLA  movements, 
however,  some  of  the  sensor  estimates  lag  behind  the  actual 
measurements,  causing  an  increase  in  the  fault  indicator 
signals.  Eventually,  the  fixed  detection  thresholds  are  exceeded, 
and  false  alarms  are  generated.  To  account  for  relatively  large 
PLA  movements,  adaptive  detection  thresholds  which  vary 
with  transient  conditions  need  to  be  introduced,  as  done  in 
reference  [1].  Then,  the  FDI  system  needs  to  be  evaluated  for 
its  diagnostic  capability  during  PLA  transients. 


CONCLUSION 

An  approach  based  on  a  bank  of  Kalman  filters  was 
investigated  for  the  development  of  an  aircraft  engine  sensor 
fault  detection  and  isolation  (FDI)  system.  This  approach 
utilizes  multiple  Kalman  filters,  each  of  which  is  designed 
based  on  a  specific  fault  hypothesis.  When  the  propulsion 
system  experiences  a  fault,  only  one  Kalman  filter  with  the 
correct  hypothesis  can  maintain  the  nominal  estimation 
performance.  Based  on  this  knowledge,  the  isolation  of  faults 
is  conducted.  The  sensor  FDI  system  developed  In  this  paper 
utilizes  a  bank  of  (m+1)  Kalman  filters  where  m  is  the  number 
of  sensors  being  monitored.  The  additional  Kalman  filter  is 
used  to  detect  component  and  actuator  faults.  With  this  setup, 
the  isolation  of  sensor  faults  or  the  detection  of 
component/aetuator  faults  can  be  achieved. 

The  sensor  FDI  system  was  applied  to  a  commercial 
aircraft  engine  simulation,  and  its  performance  was  evaluated  at 
multiple  power  settings  at  a  cruise  operating  point.  After  an 
extensive  evaluation,  the  following  three  conclusions  can  be 
made:  1)  the  FDI  system  can  correctly  isolate  a  faulty  sensor,  2) 
the  FDI  system  can  tolerate  variations  In  sensor  noise  and 
model  uncertainty,  and  3)  the  FDI  system  is  robust  to 
component  and  actuator  faults  in  terms  of  avoiding 
misclassifications.  Some  difficulties  in  isolating  faults  in  two 
sensors  due  to  the  influence  of  the  engine  control  system  were 
noted.  Further  study  is  needed  in  the  area  of  integration  with 
control  systems  for  performance  improvement  of  the  FDI 
system. 
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